Extracted

• • Target
    New Order.exe
  • Size 1.2MB
  • SHA256 bfda36d3ebc1fb857cb54351080065ade276dc8f3a4123642c733f9b46ff89c0
  • MD5 609d401e53e8dd8651a9e36619d155db
  • SHA1 01562ed1b8d6ab5e467008a1f545c785b8bbc436
  • SHA512 3e96500f78a273ccdca13889475ecb52bcfe83a5dcf1e19102288c25816fe83ba1b7eb794e55ecc64a4d052b17916f29fc210d74bea8cd625723b88fe56942fc
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2